Key points
- Ethereum developers merged a fix on October 26, 2026, for a Glamsterdam bug that could have credited staking deposits meant for new validators to block builders.
- Researcher George Avsetsin found that under the draft rules, a builder deposit sharing a validator’s public key could capture ETH meant to activate that validator, with no losses reported.
- The fix sorts deposits by withdrawal credentials; client teams must still integrate it before Glamsterdam reaches mainnet, and the planned Hoodi testnet launch was postponed.
Ethereum developers merged a fix on Monday for a flaw in the upcoming Glamsterdam upgrade that could have credited staking deposits meant for new validators to block builders, letting an operator withdraw the $ETH. The change entered Ethereum’s consensus specifications on October 26, 2026, and no losses have been reported.
Glamsterdam separates two jobs that Ethereum currently bundles together. Builders assemble blocks of transactions, while validators stake ETH to secure the network and confirm those blocks. The split comes from EIP-7732, a change known as enshrined proposer-builder separation that turns builders into in-protocol participants able to deposit ETH. The network is supposed to track builder funds and validator funds separately.
What the Ethereum Glamsterdam Bug Allowed
Researcher George Avsetsin, who posts under the handle avsetsin, identified the Ethereum Glamsterdam bug. The network uses a first-deposit-wins rule, where the first valid deposit for a given public key sets the withdrawal credentials that decide who controls the staked ETH. If an operator first registered as a builder using a particular public key, and a staking service later deposited ETH to start a validator under that same key, the draft rules would credit both deposits to the builder.
No validator would exist in that case, so the staking service could not produce the proof it needs to recover the money. Avsetsin showed that the operator could then withdraw the ETH from the staking protocol. Client teams described the problem as a conditional code flaw. No evidence of exploitation has surfaced.
Rejected, Then Merged
Core developers first closed the proposed fix on October 19, citing weak support from client teams, before reopening it after further review. Justin Traglia, a core developer and co-author of EIP-7732, merged the change on Monday. The updated rules now sort pending deposits by their withdrawal credentials, which keeps validator deposits attributed to the validator.
Dmitry Gusakov, Head of Engineering at Lido Finance, flagged the danger to staking protocols on October 20 during a core developers call, warning that an operator could place a builder deposit ahead of a staker’s validator deposit. Gusakov advised staking services to check deposits themselves during the transition. Developers logged the discussion as consensus-specs issue #5735.
Client teams still have to build the fix into their software before Ethereum activates Glamsterdam on mainnet. Glamsterdam has run on the Sepolia test network since October 6, though developers postponed its planned launch on the Hoodi test network, which had been set for October 26. They have not announced a mainnet date.
Editorial Note: Reported and edited by the Crypto India Magazine editorial team. We use AI tools to assist with research and drafting; every article is reviewed and fact-checked by our editors.
Interested in advertising with CIM? Talk to us!
Zcash Co-Founder Sean Bowe Proposes Ending ZCG Grants Funding
Zcash co-founder Sean Bowe has published a draft proposal to end the Zcash grants funding stream, arguing the Zcash Community Grants treasury of about $125 million can run for years without fresh inflows. The redirected 8% share would move to the Network Sustainability Mechanism.
JPMorgan Brings JPM Coin Dollar Deposit Token to Ethereum
JPMorgan Chase is bringing JPM Coin (JPMD), its US dollar deposit token, to Ethereum for institutional clients, moving beyond Base where it launched in November 2025. Kinexys cited Ethereum’s onchain liquidity. The token stays restricted to approved, vetted counterparties.
XRP Ledger Activates Permission Delegation for Institutions
The XRP Ledger activated permission delegation on October 8, letting an account owner authorize another account to send specific transactions without sharing master keys. The XRPL documentation advises against delegating PaymentBurn for now.
A $2 Billion Ethereum Layer 2, Blast Is Shutting Down as Its Assets Fall 98%
Blast, an Ethereum layer 2 that once held more than $2 billion, is winding down after its value locked fell about 98% and costs outran revenue. Users have until October 26 to withdraw. It is the latest in a wave of 2026 layer 2 closures as the market thins.